Long-Term Memory Authority Laundering

Description

The paper describes a reproducible agent-memory poisoning issue: untrusted content stored in persistent memory can later influence consequential actions after its origin is laundered through agent summarization, trusted-tool echo, or manufactured corroboration. The paper reports that content scoring, lineage, and single-session capability/IFC defenses remain vulnerable because they decide authority from malleable content or derivation signals. This is a paper-reported evaluation; it was not independently reproduced here.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2606.24322 (opens in a new tab)

Impact

A poisoned memory can steer later payments, purchases, setting changes, tool selection, or data egress across sessions. In the paper’s unified benchmark, the reported laundering ASR was 68% for trust scoring and capability/IFC and 47% for lineage, while the proposed origin-bound monitor reported 0% ASR with 100% legitimate utility. These are author-reported measurements, not independently verified facts.

Affected Systems

• LLM agents with persistent long-term memory
• Memory systems that authorize actions using content trust scores or malleable lineage
• Agents that summarize untrusted inputs into memory
• Agents that pass untrusted memory through trusted tools
• Mem0-backed agent memory in the paper’s evaluation

Mitigation Steps

• Bind memory authority to authenticated write-time origin rather than inferred content or mutable lineage.
• Propagate the lowest-integrity origin label through summarization, consolidation, retrieval, and tool-call boundaries.
• Treat trusted-tool output as untrusted when any security-relevant input derives from untrusted memory.
• Gate consequential actions on trusted-derived values, independent trusted corroboration, or fresh action-bound user authorization.
• Require corroborators to have distinct authenticated identities, administrative domains, and upstream data sources; do not count repeated untrusted claims.
• Use single-use authorization bound to the exact action and security-relevant value to prevent replay or substitution.
• Maintain tamper-evident audit logs for writes, elevations, and allow/deny decisions.

Evidence

• Primary source abstract: https://arxiv.org/abs/2606.24322 (opens in a new tab) — states that persistent memory poisoning can steer later payments, setting changes, or data exfiltration, and identifies summarization, trusted-tool echo, and manufactured corroboration as laundering channels.
• Primary source Sections I–II: https://arxiv.org/html/2606.24322 (opens in a new tab) — defines the cross-session write-retrieve-act issue, gives a defensive example of a poisoned web-derived note later steering data egress, and scopes the adversary to untrusted external content.
• Primary source Section V: https://arxiv.org/html/2606.24322 (opens in a new tab) — defines MEM-INV-Bench across 12 domains, five consequential tool types, direct and laundering attacks, and eight frontier models.
• Primary source Section VI, Table I: https://arxiv.org/html/2606.24322 (opens in a new tab) — reports pooled direct/laundering ASR and utility: none 84/68/100, trust_score 0/68/100, lineage 0/47/100, capability_ifc 84/68/100, and TMA-NM 0/0/100.
• Primary source Section VI, Tables II–III: https://arxiv.org/html/2606.24322 (opens in a new tab) — reports per-model and pooled consequential-action results for gpt-5-chat, gpt-4o-mini, Claude, Gemini, Llama, DeepSeek, and Qwen models.
• Primary source Sections III–IV: https://arxiv.org/html/2606.24322 (opens in a new tab) — specifies write-time origin binding, non-malleable propagation, independent corroboration or fresh action-bound authorization, and the bounded TLA+ security claims.
• Directly linked artifact README: https://github.com/yedidel/mem-inv-bench (opens in a new tab) — provides synthetic benchmark scenarios, logged results, offline monitor tests, and TLA+ models; the repository states the scenarios use fictitious accounts and recipients for authorized defensive evaluation. Artifact existence was checked, but its results were not rerun independently.